Disclosure Without Written Authorization

It is the policy of the Oklahoma State Department of Health (OSDH) to maintain the confidentiality of the medical and personal information imparted to us by our clients. Generally, information is released only with the written authorization of the client except as outlined below. In all cases, only the minimum amount of information necessary to perform the service may be released.

Protected Health Information (PHI) may be released without prior written authorization of the client/consenter in the following circumstances:

Treatment: The minimum information necessary may be released from a client’s medical record when required to ensure the continued treatment of an OSDH client. For instance, we may share maternity information about a client who is receiving maternity services from an OSDH clinic with the physician who will perform the delivery or provide post delivery care. We may consult with other providers as necessary to ensure that the service we are providing is appropriate.

Payment: The minimum information necessary may be released from a client’s medical record when the purpose of the release is to obtain payment from a third party. For instance, we may release diagnosis codes, procedure codes, service dates and other information required by the Oklahoma Medicaid Program when it is necessary to collect reimbursement for services provided to clients with Medicaid eligibility.

Operations: The minimum information necessary may be released from a client’s medical record when the purpose of the release involves the day-to-day operation of our business. For instance, program managers and state auditors may inspect client records to ensure that program guidelines and state and federal statutes are followed.

It is also permissible to access protected health information found in PHOCIS, OSIIS and other OSDH client databases when the purpose of the access is the registration of the client, creation of an appointment or reporting a service. However, accessing client information when not involved in the care of the client is strictly forbidden. For instance, looking at the PHOCIS information of family members, friends and acquaintances when not directly involved in a service to that person is not allowed.

Other examples of when Protected Health Information may be disclosed without a written authorization include:

1. When ordered to do so by a valid court order;
2. During investigation of suspected child abuse or neglect;
3. When required by state law, such as those Public Health codes that require reporting of certain diseases and injuries to OSDH.